Holiday fraud starts in the run-in, not on black Friday

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Kasada's research: Holiday fraud is moving earlier in the season, with bots, fake accounts, account takeover and refund abuse clustering before and after peak sale periods.

Why it matters: IAM, fraud, identity verification and platform teams need to treat seasonal fraud as a lifecycle problem, because the controls that fail in the run-in are the ones that determine whether peak-period abuse succeeds.

By the numbers:

• 924K+ automated checkouts were claimed in monitored communities this quarter, across 710+ retailers.
• Tracked marketplace listings rose 52% by September after a cluster of marketplaces collapsed in August.
• It costs less than $100 to build a synthetic identity that can pass onboarding checks.
• KasadaIQ tracked a 3.5x rise in Telegram refund fraud signals in 2026.

Context

Holiday fraud is best understood as a timing problem as much as a scale problem. Criminals build capacity before the obvious sales dates, then move from scraping and fake registrations into account takeover, loyalty draining and refund abuse once customers and merchants are distracted. The relevant governance gap is that many controls still assume the attack peaks on the sale day itself, not in the weeks leading up to it.

For IAM, fraud and identity verification teams, the practical issue is that clean onboarding checks and login success do not prove the same user is still legitimate later in the journey. The same identity can be manufactured cheaply, aged over time and reused across channels, which makes static assurance too weak for seasonal abuse patterns.

That starting point is typical for large-scale retail and digital platform fraud: the attacker optimises for the earliest controllable window, not the most visible one.

Key questions

Q: What should teams do first when seasonal bot fraud starts to rise?

A: Start by tightening step-up verification and bot detection at the points where automation is entering the journey, such as login, account creation and checkout. Then rate-limit high-volume requests, block disposable email and proxy patterns, and review whether any trusted device or session tokens are being overissued. Seasonal spikes usually mean fraudsters are testing weak controls, not just increasing volume.

Q: What fails when synthetic identity fraud gets past onboarding?

A: The core failure is that the system has already accepted a fabricated person as real, so every downstream control starts from a false identity. Behavioural monitoring, credit checks, and complaint-based detection become weak because there is no real victim to surface the fraud. The right response is to strengthen proofing before account creation, especially where access or financial value can be built over time.

Q: How can fraud teams connect checkout abuse to later refund claims?

A: Connect the two by correlating shared identity signals such as device fingerprint, IP range, account age, payment instrument, shipping address and session behaviour across the purchase and refund lifecycle. Fraud teams often use link analysis and case grouping to show that the same bot-driven account or mule network later submits the refund claim, even when the claimant details differ.

Q: How should security teams govern agentic AI in fraud detection?

A: Start by separating detection support from decision authority. Agentic AI can correlate signals quickly, but any action that changes customer treatment, case priority, or compliance status needs explicit policy, traceability, and a human escalation path. Governance should define what the system may recommend, what it may execute, and what always requires review.

Technical breakdown

How bot run-in campaigns build aged accounts

Fraud crews often start with low-friction activity such as scraping, registration, and account warming. The goal is not immediate theft but account legitimacy, because aged accounts are less likely to trip velocity rules or challenge flows when the real abuse begins. This is why the run-in period matters: the attacker is building inventory, reputation and trust surface before the peak event. In practice, the campaign blends automation with realistic interaction patterns so the account appears ordinary by the time it is monetised.

Practical implication: Shift bot detection, registration friction and anomaly thresholds earlier than the peak sales period.

Why synthetic identities defeat simple KYC checks

A synthetic identity combines real and fabricated data elements so it can pass onboarding logic without belonging to a real person. The weak point is that many assurance flows verify the consistency of the submitted attributes, not the existence of a genuine underlying identity. When documents, contact details and behavioural cues can all be bought or assembled, a pass on the check only proves the input set was convincing, not that the customer is authentic.

Practical implication: Add lifecycle-based risk signals and post-onboarding monitoring to identity verification workflows.

How refund fraud turns peak sales into delayed losses

Refund fraud is the trailing edge of a seasonal abuse cycle. Criminals wait until legitimate purchases, gift balances or loyalty credits have settled, then convert them into claims, chargebacks or value-draining disputes. The delay matters because it separates the act of purchase from the act of abuse, which makes the loss harder to connect to the original transaction. Once merchants treat refunds as an isolated finance issue, they miss the fraud pattern that started weeks earlier in account creation and checkout abuse.

Practical implication: Join refund monitoring to fraud and identity signals so delayed claims can be linked back to earlier abuse patterns.

Threat narrative

Attacker objective: The objective is to monetise trusted customer accounts and payment flows at scale while pushing the visible loss into the refund period.

1. Entry begins with automated scraping, fake registrations and account warming during the run-in period, before the main sale window opens.
2. Credential or account abuse follows when the attacker uses aged accounts, stored payment methods, loyalty balances or recovery paths to pass into trusted workflows.
3. Impact lands in checkout abuse, account takeover, loyalty draining and refund fraud, with losses extending well beyond the sale days.

NHI Mgmt Group analysis

Seasonal fraud is a control-timing problem, not just a volume problem. The critical failure is assuming that abuse begins at the sale moment rather than in the run-in window when bots age accounts, map flows and seed trust. That shifts the governance question from peak-day detection to pre-peak control placement. Practitioners should treat seasonal readiness as an access and identity lifecycle issue, not a holiday traffic issue.

Synthetic identity has become a governance gap between verification and trust. A check that only validates document consistency can still admit a fabricated person into a programme. That gap matters because later controls often inherit the original assumption that the account is real. Teams need to govern identity assurance as an ongoing trust decision, not a one-time verification event.

Refund fraud exposes the boundary between fraud operations and identity governance. The loss often appears late, but the enabling signals show up early in account creation, checkout behaviour and recovery abuse. When those functions sit in separate operational silos, the organisation loses the chain of evidence that links one trusted identity to a delayed claim. This is where fraud and IAM teams need shared ownership of the customer journey.

Agentic automation is now part of the threat model for retail fraud. The report's emphasis on automated checkouts and account abuse shows that defenders are no longer dealing with simple scripted traffic. They are facing adversaries that can adapt configurations, rotate infrastructure and re-enter under different marketplace identities. That makes static rules too brittle for peak season defence, especially where fraud and cyber convergence is still immature.

Holiday fraud now has an identity supply chain. Criminal marketplaces, onboarding data and stolen account value form a repeatable system that supports the entire attack cycle. The named concept here is fraud trust compression: the shrinking gap between fake identity creation and monetisation. When that gap compresses, the organisation has less time to detect, correlate and intervene before losses harden.

What this signals

The practical shift for defenders is that fraud readiness now belongs in pre-season planning, not as a holiday-only surge response. Teams that wait for Black Friday to tune rules are already behind, because the attacker has used October and early November to age accounts, test recovery paths and prepare monetisation routes.

Fraud trust compression: the gap between fake identity creation and monetisation is shrinking. That compression means identity assurance, checkout protection and refund monitoring have to be governed as one control surface, or the fraud chain will keep moving faster than the response model.

For programmes that still separate fraud, IAM and customer support, the warning is simple: delayed losses will keep rising unless the organisation can see the same identity across onboarding, purchasing, recovery and refunds. Fraud and cyber convergence becomes an operating model issue, not a collaboration slogan.

For practitioners

• Bring peak-season monitoring forward Move checkout, login, registration and account recovery monitoring into the run-in period, before the obvious sale dates, so bot build-up is visible while it is still low-value.
• Tighten customer journey controls Apply step-up checks, rate limits and behavioural anomaly detection to checkout and account pages that signed-in customers can reach, especially where stored cards, points or carts are in scope.
• Link onboarding to downstream abuse signals Feed account recovery, refund, chargeback and loyalty abuse signals back into identity verification decisions so a clean onboarding result does not stay trusted forever.
• Stage fraud freezes before the holiday peak Pre-authorise freezes for points, gift balances and high-risk stored value so the response can be triggered immediately when abuse spikes, rather than waiting for manual approval.
• Treat AI-assisted fraud as an adversary capability Assume automated actors can change pace, sequence and infrastructure quickly, then test whether your rules still work when the attacker no longer behaves like a fixed script.

Key takeaways

• Holiday fraud now starts before the sales peak, with bots and fake accounts used to prepare trusted access paths in advance.
• Synthetic identities and delayed refund abuse show that a clean onboarding result does not prove the customer remains trustworthy later in the lifecycle.
• The strongest defence is to connect verification, checkout monitoring and refund controls into one fraud and identity governance loop.

Related NHI Mgmt Group resources: Fraud and Cyber Convergence Guide · Threat Intelligence for Identity and NHI Guide · Pyramid of Pain Guide · Threat Profiling for Your Organisation Guide

Key terms

• Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
• Refund Fraud: Refund fraud is the misuse of return or reimbursement processes to obtain money, product, or service without a valid basis. It can involve repeated claims, false delivery disputes, partial return manipulation, or fabricated tracking evidence. Effective controls rely on claim history, pattern analysis, and coordination between fraud and customer service teams.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Behavioral Anomaly Detection (BAD): Behavioral Anomaly Detection (BAD) is the analysis of user, device, or system behaviour to spot activity that departs from a normal baseline. Defenders use it to detect account takeover, insider misuse, and stealthy malware when attackers imitate legitimate actions, so they must tune baselines, reduce false positives, and investigate unusual sequences, timing, and access patterns.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity control to the wider security programme without losing operational detail.